Eight years after founding Women in Cyber Unlimited, Clare Johnson believes greater awareness of gender inequality has yet to translate into meaningful progress. Speaking to DIGIT, she discusses the cultural barriers facing women in cyber security, the limitations of traditional recruitment practices and the changes needed to build a more inclusive industry.*

When Clare Johnson founded Women in Cyber Unlimited in 2018, she wanted to address the lack of visibility and representation of women working in cyber security.

Eight years later, while awareness of gender inequality has improved, progress in addressing the industry’s longstanding imbalance has been considerably less encouraging.

According to the UK Government’s Cyber Security Skills in the UK Labour Market 2026 report, women account for just 16% of the sector’s workforce, down from 17% in the previous year’s findings. At senior levels, representation falls to just 12%.

For Johnson, who is also Head of Capability at ITSUS Consulting, the figures illustrate the disconnect between the industry’s growing commitment to diversity and the results of those efforts.

“Sadly, not as much as I’d have liked,” she says when asked how much has changed since establishing Women in Cyber Unlimited.

“There is a lot more awareness around diversity issues. There are more networks, so that’s good.”

“But in terms of people actually in the job, it’s not improving.”

Johnson believes the challenge runs deeper than simply encouraging more women to consider careers in cybersecurity.

While initiatives such as TechFirst (previously CyberFirst) have helped increase interest in computing among girls, she suggests the industry has been less successful in translating that progress into employment and career advancement.

“I think it’s a significant cultural issue,” she explains.

Discussing the lack of representation at senior levels, Johnson points to the tendency for established leadership teams to recruit people with backgrounds and characteristics similar to their own.

“Typically people like to recruit people that look like themselves. So it’s a self-perpetuating problem.”

For Johnson, this creates challenges throughout the career pipeline, from securing an initial position to progressing into more senior roles.

“It’s perhaps at career level where the biggest challenge lies: , getting people into jobs, keeping them in those jobs, and then promoting them.”

She argues that employers need to be more proactive about encouraging women to pursue opportunities, particularly when recruitment practices have historically failed to attract a diverse range of candidates.

Her own career provides an example of the value of unconventional routes into the profession.

Having initially studied music alongside computing, Johnson began working with technology through a charity operating across Wales, where she found herself helping colleagues learn to use their computers.

This led to a career in IT education and, eventually, cyber security.

She believes people entering the sector from disciplines such as languages, psychology and other sciences can bring perspectives that complement traditional technical expertise.

“Cybersecurity is such a broadsector, with really varied challenges,” she says, explaining that people from different professional backgrounds can approach problems in ways that might not occur to those whose careers have been exclusively focused on IT.

“So they bring a lot of extra insight into the role.”

Johnson recalls being one of just two women in a computing class of approximately 60 students during her university studies. At the time, however, she says the imbalance barely registered.

“I didn’t feel like I was the odd one out or anything. I felt like I was perfectly entitled to be there.”

It was only when progressing into senior cyber security positions that she became more conscious of being in the minority.

“The time I really noticed it was when I got into more senior cybersecurity roles,” she explains, recalling attending meetings where she felt increasingly conscious of how colleagues might perceive her contributions.

“And imposter syndrome starts to kick in then.”

Rethinking Recruitment and Workplace Culture

Through Women in Cyber Unlimited, Johnson supports organisations looking to improve representation while helping women connect with opportunities across the industry.

One of the recurring frustrations she encounters is that businesses often recognise the need to improve diversity without changing the practices that have contributed to the problem.

“People say they want to improve diversity but then don’t do anything about it.”

She describes conversations with employers frustrated at receiving very few applications from women, despite repeatedly advertising vacancies through the same recruitment channels.

“You can’t keep doing the same thing over and over again and expect to get a different outcome.”

Her argument is straightforward: if existing recruitment methods consistently fail to reach women, organisations need to reconsider both where they advertise and how they present opportunities.

“If you’ve identified that that’s not attracting women to your job advert, then perhaps you’re looking in the wrong places. You could advertise in a different arena, or change the wording of your job description to sound more appealing to women.”

Importantly, Johnson does not believe the issue necessarily stems from deliberate attempts to exclude women.

“I genuinely think that, in many cases, it’s not deliberate,” she says, describing employers who struggle to understand why their efforts are failing.

She suggests seemingly innocuous details in job descriptions can communicate an organisational culture that appeals more strongly to certain candidates than others.

For example, advertising a workplace’s social culture through references to regular beer nights or evening activities might unintentionally discourage applicants with different interests or responsibilities.

These signals can be difficult for established teams to recognise, particularly when the culture being promoted reflects their own experiences and preferences.

Johnson therefore recommends involving women in reviewing recruitment materials, even where those colleagues do not work directly in the department advertising a vacancy.

The same principle applies to the interview process.

“Have a woman on that panel because they will see stuff that withthe best will in the world, the men might not notice.”

To illustrate the point, Johnson suggests reversing the situation and imagining a male candidate entering a workplace filled with traditionally feminine furnishings, with social activities built around interests he might not share.

Although the organisation might genuinely welcome male applicants, the candidate could leave feeling that the workplace was not somewhere he would belong.

“And that’s what happens to women a lot of the time,” she explains.

“They go for that interview, or they look at the business. Everything looks masculine, the imagery, the colours, the language used, the photographs of the board. It can feel very unwelcoming..”

For Johnson, such cultural signals demonstrate why improving diversity involves more than introducing recruitment targets or expressing support for greater representation.

Employers must also consider how their existing workplace environment might be perceived by people who do not fit the organisation’s traditional profile.

Meanwhile, the growing influence of artificial intelligence presents both opportunities and challenges for making cyber security more inclusive.

Johnson is optimistic that emerging technologies can create new routes into the profession, but remains concerned about the potential for AI systems to reinforce existing biases.

“I like to think of everything as being an opportunity because I’m an optimist in that respect,” she says.

“But I totally agree that there are huge risks, and particularly in the AI biases that we know exist.”

She recalls using AI assistants for personal tasks and encountering responses that incorrectly assumed she was male, despite previous conversations in which she had identified herself as a woman.

In another instance, an assistant made assumptions about her domestic circumstances without being given any relevant information.

“An AI agent made an assumption about who I am and who I live with, and that worries me greatly as it demonstrates an inherent bias.”

For Johnson, these experiences illustrate the importance of challenging assumptions embedded within technologies that are increasingly influencing professional and personal decisions.

In Wales, she believes there are encouraging examples of organisations working to address some of the industry’s barriers.

Women in Cyber Unlimited has received support from the Welsh Government, including assistance with promoting its activities and opportunities to develop international connections.

“We’ve had quite a lot of support from Welsh Government,” Johnson says, primarily through promoting the network, supporting our activities and facilitating connections across the UK and Europe..

“We’ve had ministerial representation at the conference that I run, which is great.”

The organisation’s professional network has also become a means for employers to reach women who might otherwise be overlooked through conventional recruitment channels.

Johnson regards this as a positive development, particularly because the willingness to seek out different networks can itself demonstrate an organisation’s commitment to attracting a broader range of candidates.

Nevertheless, she acknowledges that Wales continues to face the same cultural obstacles affecting the wider UK cyber security industry.

Looking ahead, Johnson hopes the next five years will finally bring measurable improvements in workforce representation.

“I’d just like to see that statistic change and go in the right direction for once,” she says.

“Because that’s tangible evidence, you know? That’s, that’s proof that whatever interventions are happening are actually working.”

Women in Cyber Unlimited is also preparing for its fourth annual conference, scheduled for 16 March 2027 at ICC Wales in Newport.

Recommended reading

• Scottish Business Confidence Rebounds Amid Tech Investment Push
• Investing in Women Code (2026) Report | Key Takeaways
• Ana Stewart’s Pathways Pledge Launches Seventh Cohort

The event is open to everyone but will continue to feature a predominantly female speaker lineup, something Johnson believes is justified while women remain underrepresented at many industry conferences.

“When it’s equal, I’ll reconsider that, but currently most events are very male-dominated, so I’m comfortable with having a female-dominated event.”

Ultimately, however, Johnson believes progress will depend on organisations being prepared to critically examine their own workforce and acknowledge where change is necessary.

“Have an honest look at your team,” she urges.

“You don’t need to tell anybody. I’m not asking you to stand up and tell me what you see. But have an honest look around you at the people you work with, and ask yourself if it’s diverse.”

For Johnson, that willingness to recognise the problem is the foundation for meaningful change.

“That’s the first step to making a change, is to see that there’s a problem there.”

And while initiatives, networks and educational programmes can all help improve representation, she believes lasting progress will ultimately require a shift in attitudes across the profession.

“If I wanted to change anything, it’d probably be mindset, really, because once you’ve achieved that, the rest will follow.”